Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2023-7249 | critical | 9.8 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows... | 2026-09-03 |
| CVE-2026-20355 | medium | 5.9 | No | Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could a... | 2026-09-02 |
| CVE-2026-20354 | medium | 5.9 | No | Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could a... | 2026-09-02 |
| CVE-2026-20281 | high | 7.5 | No | A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Sess... | 2026-09-02 |
| CVE-2026-78222 | high | 7.5 | No | A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted Ja... | 2026-09-02 |
| CVE-2026-76759 | high | 7.3 | No | Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | 2026-09-02 |
| CVE-2026-76758 | medium | 5.9 | No | Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*. | 2026-09-02 |
| CVE-2026-73717 | high | 7.5 | No | A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthe... | 2026-09-02 |
| CVE-2026-73716 | high | 7.5 | No | A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauth... | 2026-09-02 |
| CVE-2026-51769 | critical | 9.8 | No | Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to res... | 2026-09-02 |
| CVE-2026-19591 | high | 8.8 | No | OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe bec... | 2026-09-02 |
| CVE-2026-78597 | medium | 4.3 | No | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality... | 2026-09-02 |
| CVE-2026-78607 | high | 7.1 | No | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-... | 2026-09-02 |
| CVE-2026-78605 | medium | 5.9 | No | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HT... | 2026-09-02 |
| CVE-2026-72654 | medium | 6.5 | No | Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abus... | 2026-09-02 |
| CVE-2026-72649 | high | 8.8 | No | Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Inj... | 2026-09-02 |
| CVE-2026-83744 | medium | 4.3 | No | A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHo... | 2026-09-02 |
| CVE-2026-77189 | medium | 6.5 | No | The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulne... | 2026-09-02 |
| CVE-2026-76006 | medium | 4.9 | No | The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all... | 2026-09-02 |
| CVE-2026-51770 | critical | 9.8 | No | Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forw... | 2026-09-02 |